A Double-Layer Detection and Classification Approach for Network Attacks

Citations Over TimeTop 14% of 2018 papers

Abstract

Network intrusion detection system (NIDS) plays a crucial role in maintaining network security. In this paper, we propose a novel double-layer detection and classification technique for network attacks. The advantage of our proposed method is that our two-layer hybird detection combines the advantage of multiple techniques, especially stacking ensemble method, and has better generalization performance. The first layer contains a GBDT classifier which is responsible for identifying DoS (Denial of Service) attacks. The second layer consists of KNN classifier and stacking ensemble classifier. KNN classifier is used to classify the DoS data from the first layer as more subtypes, such as, smurf, pod, neptune, teardrop, back and other DoS attack subtypes. Stacking ensemble classifier optimized by FOA (Fly Optimization Algorithm) is applied to divide the nonDoS data from the first layer to Normal, Probe, R2L (Remote to Local) and U2L (User to Root). The simulation and analysis are done based on KDD99 dataset and we use accuracy, precision rate and recall rate to evaluate our method. The experimental results suggest that our proposed method is a more robust and reliable model and can achieve higher accuracy than other previous methods.

Related Papers

• Analysis of Network Intrusion Detection Technology(2011)
• → Design and Implementation of an Initiative and Passive Network Intrusion Detection System(2009)3 cited
• → Research on Network Security System Based on Intrusion Detection(2010)1 cited
• Experiment Research of Campus Network Intrusion Detection System(2011)
• Study on Intrusion Detection in Network Security System and its Application(2003)